Subject: [sacm] SACM/MILE at IETF 101

From: Adam Montville <[email-masked]>
Date: Thu, 15 Feb 2018 15:43:10 -0600

Hello all...

As mentioned in a previous note, a couple of us are getting together to work a fairly simple configuration assessment scenario using disparate components connected to an XMPP-Grid. We have received some interest off-list in the XMPP-Grid side of things (per the latest draft [1], it seems that XMPP-Grid is an XMPP server running a few XEP extensions), and we are hopeful that we will be able to simply use a grid as clients and not have to implement the grid itself or spend time configuring one.

Assuming that works out the way we hope, we will mock up an assessment policy publisher and modify an existing assessor and dashboard, so that four interfaces must be defined: 1) publisher interface for assessment guidance, 2) subscriber interface for assessment guidance, 3) publisher interface for assessment results, 4) subscriber interface for assessment results.

What we hope to learn is twofold. First we hope to learn more about the nuances of working with XMPP-Grid for something other than IODEF payloads. Second, we hope to learn more about how we would need to structure drafts to specify capability interfaces and then bind them to XMPP-Grid.

Our plan is to share our experience (success/failure) at the hackathon itself, but also (at the chairs' pleasure) in the SACM session, whenever that may be. We would be happy to do the same for MILE,  if that makes sense. There's really nothing there yet, but we've got a GitHub repository set up at [2]. Caveat: Not all code will be available in the repository, and we intend to use it primarily for the integration pieces and documentation.

Kind regards,

Adam (and Bill)

[1] https://datatracker.ietf.org/doc/draft-ietf-mile-xmpp-grid/ <https://datatracker.ietf.org/doc/draft-ietf-mile-xmpp-grid/> 
[2] https://github.com/CISecurity/Integration <https://github.com/CISecurity/Integration>

---

From: John Field <[email-masked]>
Date: Fri, 16 Feb 2018 10:55:00 -0500

Adam,

Thanks, this sounds like it could be very productive.  Unfortunately due to
scheduling concerns I won't be able to attend IETF 101.  It's possible I
could attend 102, but I won't know until the date draws nearer.

John

On Thu, Feb 15, 2018 at 4:43 PM, Adam Montville <[email-masked]>
wrote:

> Hello all...
>
> As mentioned in a previous note, a couple of us are getting together to
> work a fairly simple configuration assessment scenario using disparate
> components connected to an XMPP-Grid. We have received some interest
> off-list in the XMPP-Grid side of things (per the latest draft [1], it
> seems that XMPP-Grid is an XMPP server running a few XEP extensions), and
> we are hopeful that we will be able to simply use a grid as clients and not
> have to implement the grid itself or spend time configuring one.
>
> Assuming that works out the way we hope, we will mock up an assessment
> policy publisher and modify an existing assessor and dashboard, so that
> four interfaces must be defined: 1) publisher interface for assessment
> guidance, 2) subscriber interface for assessment guidance, 3) publisher
> interface for assessment results, 4) subscriber interface for assessment
> results.
>
> What we hope to learn is twofold. First we hope to learn more about the
> nuances of working with XMPP-Grid for something other than IODEF payloads.
> Second, we hope to learn more about how we would need to structure drafts
> to specify capability interfaces and then bind them to XMPP-Grid.
>
> Our plan is to share our experience (success/failure) at the hackathon
> itself, but also (at the chairs' pleasure) in the SACM session, whenever
> that may be. We would be happy to do the same for MILE,  if that makes
> sense. There's really nothing there yet, but we've got a GitHub repository
> set up at [2]. Caveat: Not all code will be available in the repository,
> and we intend to use it primarily for the integration pieces and
> documentation.
>
> Kind regards,
>
> Adam (and Bill)
>
>
> [1] https://datatracker.ietf.org/doc/draft-ietf-mile-xmpp-grid/
> [2] https://github.com/CISecurity/Integration
>
> _______________________________________________
> mile mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/mile
>
>

-- 

John P. Field | Security PM | Pivotal

Direct: (908) 962-3394 | jfield@ <[email-masked]>pivotal.io

---

From: Adam Montville <[email-masked]>
Date: Sun, 18 Feb 2018 06:10:43 -0600

John,

Looking forward to at least getting your feedback and any guidance you might be able to offer along the way. We're working within the GitHub repository (reference [2] in the original email), which is now starting to be populated with documentation and some code projects. Feel free to submit issues to that repository, reach out on this (or a new) thread on one of these lists, or (of course) directly.

Perhaps you'll be able to attend 102. Our "plans" include iterating over our progress for each hackathon to continue discovering. It's quite possible that the next hackathon might investigate an event-based approach to assessment and add to our interfaces the necessary communications for establishing watch lists and triggering criteria, etc.

Kind regards,

Adam
 
> On Feb 16, 2018, at 9:55 AM, John Field <[email-masked]> wrote:
> 
> Adam,
> 
> Thanks, this sounds like it could be very productive.  Unfortunately due to scheduling concerns I won't be able to attend IETF 101.  It's possible I could attend 102, but I won't know until the date draws nearer. 
> 
> John
> 
> On Thu, Feb 15, 2018 at 4:43 PM, Adam Montville <[email-masked] <mailto:[email-masked]>> wrote:
> Hello all...
> 
> [email-masked] <mailto:[email-masked]>
> https://www.ietf.org/mailman/listinfo/mile <https://www.ietf.org/mailman/listinfo/mile>
> 
> 
> 
> 
> -- 
> Direct: (908) 962-3394 | jfield@ <mailto:[email-masked]>pivotal.io <http://pivotal.io/>  
>